Securing Raspberry Pi (SSH keys, firewall) - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this SSH key generation command?

You run the command ssh-keygen -t ed25519 -C "pi@raspberry" on your Raspberry Pi. What will be the expected output message after successful key creation?

Raspberry Pi

ssh-keygen -t ed25519 -C "pi@raspberry"

A

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/pi/.ssh/id_ed25519):
Your identification has been saved in /home/pi/.ssh/id_ed25519.
Your public key has been saved in /home/pi/.ssh/id_ed25519.pub.
The key fingerprint is:
ed25519 SHA256:... pi@raspberry
The key's randomart image is:
+--[ED25519 256]--+
|                 |
|                 |
+----[SHA256]-----+

B

Generating RSA key pair.
Enter file in which to save the key (/home/pi/.ssh/id_rsa):
Your identification has been saved in /home/pi/.ssh/id_rsa.
Your public key has been saved in /home/pi/.ssh/id_rsa.pub.
The key fingerprint is:
RSA SHA256:... pi@raspberry
The key's randomart image is:
+--[RSA 2048]-----+
|                 |
|                 |
+----[SHA256]-----+

C

Error: Unsupported key type ed25519.
Please use rsa or dsa.

D

Permission denied (publickey).
Could not save the key.

💡 Hint

The command specifies the ed25519 key type, which is modern and supported.

The command ssh-keygen -t ed25519 generates an Ed25519 key pair. The output confirms the key type, file locations, fingerprint, and shows a randomart image. Options A, B, and C are incorrect because A shows a permission denied error, B shows RSA keys, and C shows an error that does not occur for ed25519.

❓ Predict Output

intermediate

What is the effect of this UFW firewall command on Raspberry Pi?

You run sudo ufw allow 22/tcp on your Raspberry Pi. What is the resulting firewall behavior?

Raspberry Pi

sudo ufw allow 22/tcp

A Blocks all incoming TCP connections on port 22.

B Disables the firewall completely.

C Allows incoming TCP connections on port 22 (SSH) through the firewall.

D Allows outgoing UDP connections on port 22.

💡 Hint

Port 22 is the default SSH port and TCP is the protocol used by SSH.

The command sudo ufw allow 22/tcp opens port 22 for incoming TCP connections, enabling SSH access through the firewall. Option C is the opposite, C disables firewall which is not done here, and D is about UDP which is incorrect for SSH.

🔧 Debug

advanced

Why does this SSH connection fail after disabling password authentication?

You disabled password authentication by setting PasswordAuthentication no in /etc/ssh/sshd_config but now cannot connect via SSH. What is the most likely cause?

Raspberry Pi

1. Edit /etc/ssh/sshd_config
2. Set PasswordAuthentication no
3. Restart ssh service
4. Try to SSH without an SSH key

Connection fails.

A The firewall is blocking port 22.

B You did not add your public SSH key to the Raspberry Pi's authorized_keys file.

C The SSH server does not support key-based authentication.

D You need to reboot the Raspberry Pi after changing sshd_config.

💡 Hint

Disabling password authentication requires key-based login to be set up first.

When password authentication is disabled, SSH login requires a valid SSH key. If the public key is not added to ~/.ssh/authorized_keys, login fails. Option B is false because SSH supports keys, A might block but is unrelated to this config change, and D is unnecessary as restarting sshd is enough.

🧠 Conceptual

advanced

What is the main security benefit of using SSH keys over passwords on Raspberry Pi?

Why is using SSH keys considered more secure than passwords for accessing your Raspberry Pi remotely?

A SSH keys automatically disable the firewall.

B SSH keys allow anyone to connect without authentication.

C Passwords are stored in plain text on the Raspberry Pi.

D SSH keys are cryptographically stronger and not vulnerable to brute-force guessing like passwords.

💡 Hint

Think about how passwords can be guessed but keys cannot.

SSH keys use strong cryptography making them resistant to brute-force attacks, unlike passwords which can be guessed or cracked. Option D is false because keys require possession of the private key, C is incorrect as passwords are hashed, and D is unrelated.

❓ Predict Output

expert

What is the number of rules after these UFW commands?

You run these commands on your Raspberry Pi:

sudo ufw reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw enable

How many active rules will sudo ufw status numbered show?

Raspberry Pi

sudo ufw reset
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw enable
sudo ufw status numbered

A 2

B 3

C 4

D 5

💡 Hint

Count only the explicit allow rules added after reset.

After reset, the firewall has no rules. Setting default policies does not add numbered rules. Adding allow 22/tcp and allow 80/tcp adds 2 rules. So ufw status numbered shows 2 rules.

Practice

1. What is the main benefit of using SSH keys instead of passwords to access your Raspberry Pi?

easy

A. It improves security by avoiding password guessing attacks.

B. It makes the Raspberry Pi run faster.

C. It allows multiple users to share the same password.

D. It disables the firewall automatically.

Solution

1. Step 1: Understand SSH key authentication

   SSH keys use a pair of cryptographic keys to authenticate users without sending passwords over the network.

2. Step 2: Compare with password authentication

   Password authentication can be vulnerable to guessing or brute force attacks, while SSH keys are much harder to crack.

3. Final Answer:

   It improves security by avoiding password guessing attacks. -> Option A

4. Quick Check:

   SSH keys = better security [OK]

Hint: SSH keys stop password guessing attacks fast [OK]

Common Mistakes:

• Thinking SSH keys make the device faster
• Believing SSH keys share passwords
• Assuming SSH keys disable firewall

2. Which command correctly generates an SSH key pair on your Raspberry Pi?

easy

A. ssh-keygen --firewall

B. ssh-keygen -p rsa

C. ssh-keygen -t rsa

D. firewall-cmd --generate-key

Solution

1. Step 1: Identify the SSH key generation command

   The standard command to create SSH keys is ssh-keygen with the -t option to specify the type, e.g., rsa.

2. Step 2: Check options for correctness

   -p changes the passphrase, --firewall and firewall-cmd are unrelated to SSH keys.

3. Final Answer:

   ssh-keygen -t rsa -> Option C

4. Quick Check:

   ssh-keygen -t rsa = generate SSH keys [OK]

Hint: Use ssh-keygen with -t to specify key type [OK]

Common Mistakes:

• Using -p instead of -t for key generation
• Confusing firewall commands with SSH key commands
• Trying to generate keys with firewall tools

3. Given the following commands run on a Raspberry Pi, what will be the output of sudo ufw status?

sudo ufw enable
sudo ufw allow ssh
sudo ufw deny 80

medium

A. Error: ufw command not found

B. Status: inactive

C. Status: active
No rules defined

D. Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80 DENY Anywhere

Solution

1. Step 1: Analyze the firewall commands

   sudo ufw enable activates the firewall. sudo ufw allow ssh opens port 22 (SSH). sudo ufw deny 80 blocks HTTP port 80.

2. Step 2: Understand the status output

   The status shows active firewall with rules allowing SSH (port 22) and denying port 80.

3. Final Answer:

   Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere -> Option D

4. Quick Check:

   Firewall enabled with SSH allow and port 80 deny = Status: active To Action From -- ------ ---- 22/tcp ALLOW Anywhere 80 DENY Anywhere [OK]

Hint: Enable ufw then add rules to see them in status [OK]

Common Mistakes:

• Assuming firewall is inactive after enabling
• Expecting no rules after adding allow/deny
• Confusing port numbers with service names

4. You tried to add your SSH public key to ~/.ssh/authorized_keys but still get password prompts. What is the most likely cause?

medium

A. The authorized_keys file has incorrect permissions.

B. The Raspberry Pi firewall is disabled.

C. You forgot to restart the SSH service.

D. You used the wrong SSH key type.

Solution

1. Step 1: Check SSH key authentication requirements

   SSH requires strict permissions on ~/.ssh and authorized_keys files to allow key login.

2. Step 2: Identify common permission issues

   If permissions are too open, SSH ignores the keys and falls back to password login.

3. Final Answer:

   The authorized_keys file has incorrect permissions. -> Option A

4. Quick Check:

   Wrong permissions block SSH key login [OK]

Hint: Check .ssh and authorized_keys permissions first [OK]

Common Mistakes:

• Thinking firewall affects SSH key login
• Restarting SSH service unnecessarily
• Assuming wrong key type without checking permissions

5. You want to secure your Raspberry Pi by allowing SSH access only from a specific IP address 192.168.1.100 and blocking all other SSH attempts. Which ufw commands achieve this?

hard

A. sudo ufw allow from any to any port 22
sudo ufw deny from 192.168.1.100

B. sudo ufw allow from 192.168.1.100 to any port 22
sudo ufw deny 22

C. sudo ufw deny ssh
sudo ufw allow 22

D. sudo ufw allow ssh
sudo ufw deny from 192.168.1.100 to any port 22

Solution

1. Step 1: Allow SSH only from the specific IP

   Use sudo ufw allow from 192.168.1.100 to any port 22 to permit SSH from that IP.

2. Step 2: Deny all other SSH connections

   Use sudo ufw deny 22 to block SSH from all other IPs.

3. Final Answer:

   sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 -> Option B

4. Quick Check:

   Allow specific IP then deny all others = sudo ufw allow from 192.168.1.100 to any port 22 sudo ufw deny 22 [OK]

Hint: Allow specific IP first, then deny all others [OK]

Common Mistakes:

• Allowing SSH globally before denying specific IP
• Denying the allowed IP instead of others
• Using wrong port numbers or commands